Privacy Policy

Last updated: 19 December 2025

Lingoala (“we”, “us”) takes the protection of your personal data seriously. This Privacy Policy explains how we process data when you use our iOS app Lingoala (“App”) or our website at https://www.lingoala.com (“Website”).

Note on use by children: The App is particularly aimed at children and is typically set up and supervised by parents or legal guardians. We assume that the setup of the App and the use of features such as parental reports is carried out by an adult. Parents/legal guardians are responsible for supervising their children’s use of the App.

1. Data Controller

Daniel Rinser
Baumhaselring 101
14469 Potsdam
Germany

legal@lingoala.com

2. Core Principle: Local Data Storage Without User Accounts

We do not require the creation of a user account with an email address or password. We do not collect users’ names, ages, or addresses.

Your vocabulary, settings, and learning progress are primarily stored locally on your device. Most App features do not require the transmission of personal data to our servers.

To manage certain features (see below), we generate a random, pseudonymous app user ID that is stored locally on your device. This ID does not allow direct identification of your person.

3. Data Processing by Feature

The following overview shows which data is processed for each feature. You can avoid optional features to exclude the corresponding data processing.

3.1 Core Features (Vocabulary Management, Vocabulary Practice, Flash Cards)

Data processed: No transmission to servers. All data is stored exclusively locally on your device.

Exception — Text-to-Speech: When words or example sentences are read aloud in the App (e.g., during exercises or upon request via a button), the corresponding text is transmitted to our server, which forwards it to Google Cloud Text-to-Speech (USA). The generated audio is cached on our server to avoid repeated requests to Google for the same text.

Legal basis: Art. 6(1)(b) GDPR (Performance of contract)
Third-party provider: Google Cloud (USA) — Transfer based on Standard Contractual Clauses (Art. 46(2)(c) GDPR)

3.2 AI Dictation (Optional)

This feature generates dictation texts based on a topic you choose or your vocabulary categories.

Data processed:

The topic you enter or — when using your own vocabulary — the words and translations from the selected categories
Your pseudonymous user ID (to enforce usage limits)
Counter of generated dictations (for fraud prevention)

Storage:

Topics and vocabulary: Only transmitted to OpenAI for processing, no permanent storage on our servers
Usage counters: Up to 24 months on our servers (Hetzner, Germany)
Legal basis: Art. 6(1)(b) GDPR (Performance of contract) for dictation generation; Art. 6(1)(f) GDPR (Legitimate interest) for usage counters for fraud prevention
Third-party provider: OpenAI (USA) for text generation and text-to-speech — Transfer based on Standard Contractual Clauses

Opt-out: If you do not use this feature, no dictation-related data will be processed.

3.3 Scan Vocabulary (Optional)

This feature extracts vocabulary from photographed book pages or worksheets.

Data processed:

The photo you take
Your pseudonymous user ID (to enforce usage limits)
Counter of scan operations (for fraud prevention)

Storage:

Photos: Only transmitted to OpenAI for processing, no permanent storage on our servers
Usage counters: Up to 24 months on our servers (Hetzner, Germany)
Legal basis: Art. 6(1)(b) GDPR (Performance of contract) for image analysis; Art. 6(1)(f) GDPR (Legitimate interest) for usage counters
Third-party provider: OpenAI (USA) for image analysis (Vision) — Transfer based on Standard Contractual Clauses

Opt-out: If you enter vocabulary manually instead of scanning, no image data will be processed.

3.4 Parental Reports (Optional)

This feature allows you to generate a web link through which parents can view aggregated learning statistics.

Data processed:

Daily activity statistics (XP points per exercise type, number of correct/incorrect answers)
Your pseudonymous user ID
A secure token for web access

Not transmitted: Individual vocabulary, scanned images, dictation topics, or other content.

Storage: On our servers (Hetzner, Germany) until deleted by you or 12 months after the last synchronisation.

Legal basis: Art. 6(1)(b) GDPR (Performance of contract)

Revoke link: You can revoke a generated link at any time in the App settings. This will invalidate the link. The statistics data remains stored and can be made accessible again via a newly generated link.

Complete deletion: To completely delete your parental report data, please contact us by email (see Section 6).

Opt-out: If you do not activate this feature, no learning statistics will be transmitted to our servers.

3.5 Pro Subscription (Optional)

If you purchase a Pro subscription, the purchase is processed through the Apple App Store.

Data processed:

Your pseudonymous user ID
RevenueCat subscription ID (to manage Pro status)

Data not processed: Payment information is processed exclusively by Apple and is not accessible to us.

Storage: Subscription status is stored at RevenueCat (USA) and on our servers (Hetzner, Germany).

Legal basis: Art. 6(1)(b) GDPR (Performance of contract)
Third-party provider: RevenueCat (USA) — Transfer based on Standard Contractual Clauses

3.6 Analytics (Automatic)

To improve the App and fix errors, we collect anonymised usage data.

Data processed:

Pseudonymous user ID (to correlate events)
App events (e.g., “screen opened”, “error occurred”)
Device model, iOS version, App version

Data not processed: Content such as vocabulary, dictation topics, or learning progress.

Storage: At PostHog (EU servers).

Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in improving the App)
Third-party provider: PostHog (EU)

3.7 Server Infrastructure (Technically Necessary)

Technical data is logged for every communication with our servers.

Data processed:

IP address
Timestamp of the request
Requested resource

Storage: Maximum 90 days on our servers (Hetzner, Germany).

Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in security and abuse prevention)

3.8 Website

Our Website is a static information site without tracking or analytics features.

Data processed:

IP address and access data in server logs (see 3.7)

Cookie for language setting: If you manually change the language of the Website, we store your preference in a cookie. This cookie is technically necessary to maintain your chosen language on subsequent visits. It does not contain any personal data and does not require consent (Section 25(2) TTDSG).

4. Overview of Third-Party Providers

Provider	Location	Purpose	Legal Basis for Transfer
Hetzner Cloud	Germany	Server infrastructure, database	— (not a third country)
PostHog	EU	Anonymised analytics	— (not a third country)
OpenAI	USA	AI Dictation, Vocabulary Scan	Standard Contractual Clauses (Art. 46(2)(c) GDPR)
Google Cloud	USA	Text-to-Speech	Standard Contractual Clauses (Art. 46(2)(c) GDPR)
RevenueCat	USA	Subscription management	Standard Contractual Clauses (Art. 46(2)(c) GDPR)

Where required, data processing agreements pursuant to Art. 28 GDPR are in place with these providers.

5. Contact & Support

If you contact us by email, your email address and message content will be processed to handle your enquiry.

When using the “Contact” function in the App, your pseudonymous user ID and device information are automatically included in the email text to facilitate troubleshooting. You can remove this information before sending.

Legal basis: Art. 6(1)(b) GDPR (Performance of contract)

6. Retention Period and Deletion

6.1 Retention Periods

We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Data Type	Retention Period	Reason
IP addresses in access logs	Maximum 90 days	Security and error analysis
Parental report statistics	Until deleted by you	Provision of the feature
Usage data (counters, costs)	As long as necessary for fraud prevention and billing purposes; at minimum in accordance with tax retention requirements	Abuse prevention, business analysis, statutory obligations (German Fiscal Code § 147)

6.2 Deletion of Your Data

Since we do not store email addresses or user accounts, we cannot identify you by name. To request the deletion of your data, please use the “Contact” function in the App (so that we receive your user ID) or provide your ID in your email to support@lingoala.com.

Upon request, we will delete:

Parental report data and associated statistics
Synchronised learning progress data on our servers

Retained data: Usage logs for fraud prevention and billing purposes (e.g., number of generated dictations, AI usage costs) are retained for legal and operational reasons. This data does not contain any learning content or personal inputs.

Local data: The App stores vocabulary and settings locally on your device. These can only be removed by uninstalling the App.

7. Your Rights

You have the following rights under the GDPR:

Right	Article	Description
Access	Art. 15 GDPR	Information about the data stored concerning you
Rectification	Art. 16 GDPR	Correction of inaccurate data
Erasure	Art. 17 GDPR	Deletion of your data, provided no retention obligations apply
Restriction	Art. 18 GDPR	Restriction of processing under certain conditions
Data portability	Art. 20 GDPR	Receipt of your data in a structured, machine-readable format
Objection	Art. 21 GDPR	Objection to processing based on legitimate interest

To exercise these rights, please contact us at the email address stated above, providing your app user ID.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at https://www.lingoala.com/privacy with the date at the beginning of the document. In the event of material changes, we will notify you through a notice in the App.